f ine + dcil nikhil swamy juan chen ravi chugh end-to-end verification of security enforcement

FINE+ DCIL

Nikhil SwamyJuan ChenRavi Chugh

End-to-end Verificationof Security Enforcement

2

Security Policies Many languages/logics to specify security policies– XACML, DKAL, SecPAL, DCC, SD3, Binder, Ponder,

CDatalog, RT, SPKI/SDSI, …

Policies address a variety of security concerns – Authentication, authorization, usage controls,

information flow, security automata, …

But, disconnect between specification and implementation

3

SecPAL policy for EHR, an e-health databaseP can read P’s record rD can read P’s record r if D is treating P and r.Subject <> HIV

C# function to enforce this policypublic Record GetRecord (string pat, string recId) { Record rec = m_data.GetRecord (pat, recId); if (rec != null && GetAuthContext().query(“CanGetRecord”, new List { pat, recId, rec.Author, rec.Subject })) { return result; } return null;}

Okay to read record before security check?

4

SecPAL policy for EHR, an e-health databaseP can read P’s record rD can read P’s record r if D is treating P and r.Subject <> HIV

C# function to enforce this policypublic Record GetRecord (string pat, string recId) { Record rec = m_data.GetRecord (pat, recId); if (rec != null && GetAuthContext().query(“CanGetRecord”, new List { pat, recId, rec.Author, rec.Subject })) { return result; } return null;}

Can credentials be forged?

Okay to read record before security check?

5

SecPAL policy for EHR, an e-health databaseP can read P’s record rD can read P’s record r if D is treating P and r.Subject <> HIV

C# function to enforce this policypublic Record GetRecord (string pat, string recId) { Record rec = m_data.GetRecord (pat, recId); if (rec != null && GetAuthContext().query(“CanGetRecord”, new List { pat, recId, rec.Author, rec.Subject })) { return result; } return null;}

Can credentials be forged?

Okay to read record before security check?

Is this the correct authorization query?

6

SecPAL policy for EHR, an e-health databaseP can read P’s record rD can read P’s record r if D is treating P and r.Subject <> HIV

C# function to enforce this policy

Unclear if policy is enforced correctly

public Record GetRecord (string pat, string recId) { Record rec = m_data.GetRecord (pat, recId); if (rec != null && GetAuthContext().query(“CanGetRecord”, new List { pat, recId, rec.Author, rec.Subject })) { return result; } return null;}

Can credentials be forged?

Okay to read record before security check?

Is this the correct authorization query?

7

Verifying Security Enforcement by Typing

Security policies embedded in a program’s types– Security checking amounts to type checking

• Volpano and Smith ’96

Many proposals– FlowCaml, Jif, Fable, Aura, F7

But, not yet widely applicable

8

Limitations of Security by Typing Cannot handle many constructs of real policies– Jif and FlowCaml: only information flow– Aura and Fable: only stateless policies– F7: targets stateless authentication

Either not meant for source programming– Fable and Aura require explicit security proofs

Or cannot be used to generate checkable binaries– Jif, FlowCaml, and F7 erase security types

9

Our Approach: FINE + DCIL Λα::*. λx:τ1. λy:{τ2|ϕ}. λz:!τ3. ...

FINE: A source-level type system for F#Refinement types for authorization policiesDependent types for information flowAffine types for state-modifying policies

Verifiable binaries by type preservationDCIL: an extension of CIL’s type systemSecurity proofs carried from source levelChecked syntactically (without Z3)

Automated security proof constructionType checked with assistance from Z3Security proofs synthesized from Z3 proofs

Type checkerZ3

class C<α::*> ...

Type checker

Expressive

Easier to program

Verify with small TCB

10

Outline Overview FINE, by example Proof terms Translation to DCIL Results and future work

11

Reference M onitor

Reference Monitor

A uthentication

Authentication

Health Records

A pplication Code

Application Code

EHR Application

12

module Authenticationtype prin = | User : str -> prin | Admin : prin

type option<‘a> = | Some : ‘a -> option<‘a> | None : option<‘a>

private type cred<p:prin> = | MkCred : p:prin -> cred<p> val login : u:prin -> str -> option<cred<u>>let login u pw = if (* password ok? *) then Some (MkCred u) else None

13

module Authenticationtype prin = | User : str -> prin | Admin : prin

type option<‘a> = | Some : ‘a -> option<‘a> | None : option<‘a>

private type cred<p:prin> = | MkCred : p:prin -> cred<p> val login : u:prin -> str -> option<cred<u>>let login u pw = if (* password ok? *) then Some (MkCred u) else None

14

module Authenticationtype prin = | User : str -> prin | Admin : prin

type option<α> = | Some : α -> option<α> | None : option<α>

private type cred<p:prin> = | MkCred : p:prin -> cred<p> val login : u:prin -> str -> option<cred<u>>let login u pw = if (* password ok? *) then Some (MkCred u) else None

Polymorphic type constructor• Type parametrized by

another type

15

module Authenticationtype prin = | User : str -> prin | Admin : prin

type option<α> = | Some : α -> option<α> | None : option<α>

type cred<p:prin> = | MkCred : p:prin -> cred<p> val login : u:prin -> str -> option<cred<u>>let login u pw = if (* password ok? *) then Some (MkCred u) else None

Dependent type constructor• Type parametrized by a term• Correlates a particular

principal with a credential

16

module Authenticationtype prin = | User : str -> prin | Admin : prin

type option<α> = | Some : α -> option<α> | None : option<α>

type cred<p:prin> = | MkCred : p:prin -> cred<p> val login : u:prin -> str -> option<cred<u>>let login u pw = if (* password ok? *) then Some (MkCred u) else None

Dependent function type• Formal parameter is

bound in range type• Way to create values of a

dependent type

17

module Authenticationtype prin = | User : str -> prin | Admin : prin

type option<α> = | Some : α -> option<α> | None : option<α>

type cred<p:prin> = | MkCred : p:prin -> cred<p> val login : u:prin -> str -> option<cred<u>>let login u pw = if (* password ok? *) then Some (MkCred u) else None

Want login to be the only way to obtain a credential for a user

18

module Authenticationtype prin = | User : str -> prin | Admin : prin

type option<α> = | Some : α -> option<α> | None : option<α>

private type cred<p:prin> = | MkCred : p:prin -> cred<p> val login : u:prin -> str -> option<cred<u>>let login u pw = if (* password ok? *) then Some (MkCred u) else None

Want login to be the only way to obtain a credential for a user

19

module EHR_ReferenceMonitorprivate type record = { patient:prin; subject:str;

data:str }

let read_data p’ c r = r.data

20

module EHR_ReferenceMonitorprivate type record = { patient:prin; subject:str;

data:str }

type perm = | CanWrite : file -> perm | CanRead : file -> perm

prop hasPerm :: prin -> perm -> *

assume Ax1 : forall f:file, hasPerm Admin (CanRead f)

val read_data : p’:prin -> cred<p’> -> {x:record | hasPerm p’ (CanRead x)} ->

str

let read_data p’ c r = r.data

read_data mediates access to patient records• The user must present a login credential

21

module EHR_ReferenceMonitorprivate type record = { patient:prin; subject:str;

data:str }

type perm = | CanWrite : file -> perm | CanRead : file -> perm

prop hasPerm :: prin -> perm -> *

assume Ax1 : forall f:file, hasPerm Admin (CanRead f)

val read_data : p’:prin -> cred<p’> -> {x:record | hasPerm p’ (CanRead x)} ->

str

let read_data p’ c r = r.data

read_data mediates access to patient records• The user must present a login credential• The record to be read must be a record x such that

hasPerm p’ (CanRead x) is true

Refinement type {x:τ | ϕ}• ϕ is a FOL+equality formula over propositions

22

module EHR_ReferenceMonitorprivate type record = { patient:prin; subject:str;

data:str }

type perm = | CanWrite : file -> perm | CanRead : file -> perm

prop hasPerm :: prin -> perm -> *

assume Ax1 : forall f:file, hasPerm Admin (CanRead f)

val read_data : p’:prin -> cred<p’> -> {x:record | hasPerm p’ (CanRead x)} ->

str

let read_data p’ c r = r.data

23

module EHR_ReferenceMonitorprivate type record = { patient:prin; subject:str;

data:str }

type perm = | CanWrite : record -> perm | CanRead : record -> perm

prop hasPerm :: prin -> perm -> *

assume Ax1 : forall f:file, hasPerm Admin (CanRead f)

val read_data : p’:prin -> cred<p’> -> {x:record | hasPerm p’ (CanRead x)} ->

str

let read_data p’ c r = r.data

24

module EHR_ReferenceMonitorprivate type record = { patient:prin; subject:str;

data:str }

type perm = | CanWrite : record -> perm | CanRead : record -> perm

prop hasPerm :: prin -> perm -> *

assume Ax1 : forall f:file, hasPerm Admin (CanRead f)

val read_data : p’:prin -> cred<p’> -> {x:record | hasPerm p’ (CanRead x)} ->

str

let read_data p’ c r = r.data

Propositions• dependent types that can

be used in refinements

25

module EHR_ReferenceMonitorprivate type record = { patient:prin; subject:str;

data:str }

type perm = | CanWrite : record -> perm | CanRead : record -> perm

prop hasPerm :: prin -> perm -> *

assume Ax1 : forall r:record, hasPerm Admin (CanRead r)

val read_data : p’:prin -> cred<p’> -> {x:record | hasPerm p’ (CanRead x)} ->

str

let read_data p’ c r = r.data

Security assumptions• establish ground facts and

inference rules for policy

26

val check : a:prin -> b:perm -> {z:bool | z=true => hasPerm a b}let check a b = match a, b with | Admin, CanRead _ -> true | _, CanRead r -> a = r.patient | _ -> false

module EHR_ReferenceMonitor

assume Ax2 : forall r:record. hasPerm r.patient (CanRead r)

Can write functions with post-conditions in return values

Additional policy rule

27

val check : a:prin -> b:perm -> {z:bool | z=true => hasPerm a b}let check a b = match a, b with | Admin, CanRead _ -> true | _, CanRead r -> a = r.patient | _ -> false

Type Checking

Ax1 : forall r:record, hasPerm Admin (CanRead r) Ax2 : forall r:record, hasPerm r.patient (CanRead r) a : prin b : perm a = Admin b = CanRead tmp

Typingcontext

Γ

Well-typed? true : {z:bool | z=true => hasPerm a b}

Valid? Not ( true=true => hasPerm a b)

Z3

28

val check : a:prin -> b:perm -> {z:bool | z=true => hasPerm a b}let check a b = match a, b with | Admin, CanRead _ -> true | _, CanRead r -> a = r.patient | _ -> false

Type Checking

Ax1 : forall r:record, hasPerm Admin (CanRead r) Ax2 : forall r:record, hasPerm r.patient (CanRead r) a : prin b : perm a = Admin b = CanRead tmp

Typingcontext

Γ

Well-typed? true : {z:bool | z=true => hasPerm a b}

Sat? not (true=true => hasPerm a b)

Z3

29

val check : a:prin -> b:perm -> {z:bool | z=true => hasPerm a b}let check a b = match a, b with | Admin, CanRead _ -> true | _, CanRead r -> a = r.patient | _ -> false

Type Checking

Ax1 : forall r:record, hasPerm Admin (CanRead r) Ax2 : forall r:record, hasPerm r.patient (CanRead r) a : prin b : perm a = Admin b = CanRead tmp

Typingcontext

Γ

Well-typed? true : {z:bool | z=true => hasPerm a b}

Sat? not (true=true => hasPerm a b)

Z3Unsat!

✓

30

val check : a:prin -> b:perm -> {z:bool | z=true => hasPerm a b}let check a b = match a, b with | Admin, CanRead _ -> true | _, CanRead r -> a = r.patient | _ -> false

Type Checking

Ax1 : forall r:record, hasPerm Admin (CanRead r) Ax2 : forall r:record, hasPerm r.patient (CanRead r) a : prin b : perm b = CanRead r

Typingcontext

Γ

Well-typed?(a = r.patient) : {z:bool | z=true => hasPerm a

b}

Sat? not ((a = r.patient)=true => hasPerm a b)

Z3Unsat!

✓

31

val check : a:prin -> b:perm -> {z:bool | z=true => hasPerm a b}let check a b = match a, b with | Admin, CanRead _ -> true | _, CanRead r -> a = r.patient | _ -> false

Type Checking

Ax1 : forall r:record, hasPerm Admin (CanRead r) Ax2 : forall r:record, hasPerm r.patient (CanRead r) a : prin b : perm

Typingcontext

Γ

Well-typed? false : {z:bool | z=true => hasPerm a b}

Sat? not (false=true => hasPerm a b)

Z3Unsat!

✓

32

val check : a:prin -> b:perm -> {z:bool | z=true => hasPerm a b}let check a b = match a, b with | Admin, CanRead _ -> true | _, CanRead r -> a = r.patient | _ -> false

Type Checking

✓

33

Type Checking

val ehr_app : p:prin -> cred<p> -> record -> option<str>

let ehr_app : p c rec = if check p (CanRead rec) then Some (read_data p c rec) else None

Is application code using API correctly?

34

val ehr_app : p:prin -> cred<p> -> record -> option<str>

let ehr_app : p c rec = if check p (CanRead rec) then Some (read_data p c rec) else None

Type Checking Is application code using API correctly?

Well-typed? rec : {x:record | hasPerm p (CanRead x)}

35

val ehr_app : p:prin -> cred<p> -> record -> option<str>

let ehr_app : p c rec = if check p (CanRead rec) then Some (read_data p c rec) else None

Type Checking Is application code using API correctly?

Well-typed? rec : {x:record | hasPerm p (CanRead x)}

Establishes the pre-condition

✓

36

Compiling with Explicit Security Proofs Proofs can be communicated between systems

to attest authorization rights

Proofs can be logged for auditing access rights

Mobile code/plugins with explicit proofs can be checked before execution

Target programs can be checked with a small TCB– Translation validation to catch compiler bugs

37

Types for Proofs Proof terms will have type pf<α> Types for logical connectives

Universal quantifiers as dependent functions

type not<α>type and<α,β>type imp<α,β>...

forall r:record, hasPerm Admin (CanRead r) && hasPerm Admin (CanWrite

r)

r:record -> pf <and <hasPerm Admin (CanRead r), hasPerm Admin (CanWrite

r)>>

38

Embedding Proof Terms in Source Before translation to target, “derefine” program Remove refinement types (not in DCIL) Each expression paired with proof of refinement

{x:τ | ϕ}

(x:τ * pf<ϕ>)

Dependent pair type• x is value of first component• x is bound in type of second component

39

Proof Combinators General proof constructors

Specialized proof constructors for each prop

Tru : pf<True> Contra : α. pf<α> -> pf<not<α>> -> pf<False> UseFalse : α. pf<False> -> pf<α> Imp : α,β. (pf<α> -> pf<β>) -> pf<imp<α,β>> Lift : α. α -> pf<α> ...

Sub_1_hasPerm : p1:prin -> p2:prin -> q:perm -> pf<eq_prin p1

p2> -> pf<hasPerm

p1 q> -> pf<hasPerm

p2 q>

40

Proof Term for check val check : a:prin -> b:perm -> {z:bool | z=true => hasPerm a b}

41

Proof Term for check val check : a:prin -> b:perm -> (z:bool * pf<imp<eq_bool z true, hasPerm a b>>)

Derefined return type

42

Proof Term for check val check : a:prin -> b:perm -> (z:bool * pf<imp<eq_bool z true, hasPerm a b>>)

let check a b = match a, b with | Admin, CanRead _ -> (true, pf1) | _, CanRead r -> (a = r.patient, pf2) | _ -> (false, pf3)

Need to supply a proof for each branch

43

Proof Term for check val check : a:prin -> b:perm -> (z:bool * pf<imp<eq_bool z true, hasPerm a b>>)

let check a b = match a, b with | Admin, CanRead _ -> (true, pf1) | _, CanRead r -> (a = r.patient, pf2) | _ -> (false, pf3)

pf1 = (Imp <eq_bool true true, hasPerm a b> (λfoo: pf<eq_bool true true>. (Sub_1_hasPerm Admin a b (Refl_prin a : (pf<eq_prin Admin a>)) (Lift <hasPerm Admin b> (Ax1 tmp)))))

Unreasonable to write these manually

44

Automatic Proof Construction Z3v2 produces a proof for an unsat formula

Z3Unsat!

46

Automatic Proof Construction

Z3 proof terms map to several FINE proof terms– n-ary logical connectives converted to binary– Our quantifier intro proofs uses many subterms– Our monotonicity proofs reason about all subterms

Opportunities for improvement– Simplifying Z3 proofs before translation– Handling tautologies and rewrites more generally

application LOC # of proof obligations

# of Z3 proof rule applications

# of FINE proof rule applications

mini ehr 32 5 131 432

mini iflow 111 20 1047 2912

mini lookout 190 7 494 3942

47

DCIL Extends the .NET Common Intermediate Language

class C <T1::*, T2::A, p:prin, λx:T1.T>

Type parameters

48

DCIL Extends the .NET Common Intermediate Language

class C <T1::*, T2::A, p:prin, λx:T1.T>

Type parameters

Affine type parameters

49

DCIL Extends the .NET Common Intermediate Language

class C <T1::*, T2::A, p:prin, λx:T1.T>

Type parameters

Affine type parameters

Value parameters (dependent classes)

50

DCIL Extends the .NET Common Intermediate Language

class C <T1::*, T2::A, p:prin, λx:T1.T>

Type parameters

Affine type parameters

Value parameters (dependent classes)

Type-level function parameters

51

Translating FINE to DCIL Type and data constructors

Dependent functions

type printype cred = MkCred : p:prin -> cred p

abstract class prin {}abstract class Cred<p:prin>{}class MkCred<p:prin> : Cred<p> { prin p; }

login : p:prin -> cred p

abstract class DepArr<arg::*, ret::arg => *>{ (ret x) App (x:arg) {}}class login : DepArr<prin, λx:prin.cred x>{ (cred p) App (p:prin) { … }}

52

Conclusions FINE+DCIL tries to bridge the gap between

policy specification and enforcement

Provides a high-level source programming model, while retaining a small TCB for verification of proof-carrying target code

But, lots left to do …– Build more applications and integrate with .NET– Optimize proof extraction

53

Thanks!

54

Extra Slides

55

Policy for Patient Records

assume forall r:record. hasPerm r.patient (CanRead r)

Recall the example SecPAL policy:P can read P’s record rD can read P’s record r if D is treating P and r.Subject <> HIV

In FINE:

56

Policy for Patient Records

assume forall r:record. hasPerm r.patient (CanRead r)

prop isTreating :: prin -> prin -> *

assume forall d:prin, r:record. (isTreating d r.patient && r.subject <> “HIV”) => hasPerm d (CanRead r)

Recall the example SecPAL policy:P can read P’s record rD can read P’s record r if D is treating P and r.Subject <> HIV

In FINE:

57

Stateful Policy for Patient Records isTreating d p can change over time In FINE, model state by passing around a store

assume forall d:prin, r:record, st:state. (isTreating d r.patient st && r.subject <> “HIV”) => hasPerm d (CanRead r)

Policy can quantifyover states

58

Stateful Policy for Patient Records isTreating d p can change over time In FINE, model state by passing around a store

assume forall d:prin, r:record, st:state. (isTreating d r.patient st && r.subject <> “HIV”) => hasPerm d (CanRead r)

Policy can quantifyover statesPropositions can refer to current state

59

Stateful Policy for Patient Records isTreating d p can change over time In FINE, model state by passing around a store

Program operations can change state of world

assume forall d:prin, r:record, st:state. (isTreating d r.patient st && r.subject <> “HIV”) => hasPerm d (CanRead r)

val visit_doctor:p:prin -> cred<p> -> doc:prin -> (st:state) -> ({st’:state | isTreating doc p st’})

Propositions can refer to current statePolicy can quantify

over states

60

Stateful Policy for Patient Records isTreating d p can change over time In FINE, model state by passing around a store

Program operations can change state of world

assume forall d:prin, r:record, st:state. (isTreating d r.patient st && r.subject <> “HIV”) => hasPerm d (CanRead r)

val visit_doctor:p:prin -> cred<p> -> doc:prin -> (st:state * !stateToken<st>) -> ({st’:state | isTreating doc p st’} * !stateToken<st’>)

Affine types to ensure stale states are not re-used

Propositions can refer to current statePolicy can quantify

over states

61

Equality Propositions

Need a proposition for equality of terms

prop eq :: α. α -> α -> *

– Requires second-order quantificiation over types– Would require bigger change to CIL

Instead, first-order treatment of equality Specialized proof constructors for each type t

type eq_t :: t -> t -> * = | Refl_t : a:t -> pf<eq_t a a>

...

% dateThu Aug 6 22:21:39 PDT 2009%% ./fine.exe test/<file>.f9 --skip_translation --extract_proofs --proof_stats